使用证书管理器和Traefik入口的404质询响应

Question

你好，我是库伯内特的新手，试着设置我的第一个环境。我想要以下方案：

< li >我的组织拥有公共IP (x.x.x.x) < li >此IP路由到带有win服务器IIS的专用局域网(即< code>192.168.0.10)中的服务器。在IIS上，我有URL重写模块，它充当反向代理 < li >我有kubernetes集群 < li >我在k8s上部署了一些服务 < li >我想通过SSL从internet访问此服务，该SSL是从“让我们加密”获得的

我已经设置了k8s集群，部署traefik（v1.7）入口并配置它们，以便让我们加密（设置超文本传输协议-

Waiting for http-01 challenge propagation: wrong status code '404', expected '200'

我的traefik配置图：

apiVersion: v1
kind: ConfigMap
metadata:
  name: traefik-conf
  namespace: kube-system
data:
  traefik.toml: |
    # traefik.toml
    defaultEntryPoints = ["http","https"]
    [entryPoints]
      [entryPoints.http]
      address = ":80"
      [entryPoints.http.redirect]
        regex = "^http://(.*)"
        replacement = "https://$1"
      [entryPoints.https]
      address = ":443"
        [entryPoints.https.tls]
    [acme]
      email = "[e-mail]"
      storage = "/acme/acme.json"
      entryPoint = "https"
      onHostRule = true
        [acme.httpChallenge]
        entryPoint = "http"
    [[acme.domains]]
      main = "my-public-domain.com"

我也尝试在那里使用通配符：

apiVersion: v1
kind: ConfigMap
metadata:
  name: traefik-conf
  namespace: kube-system
data:
  traefik.toml: |
    # traefik.toml
    defaultEntryPoints = ["http","https"]
    [entryPoints]
      [entryPoints.http]
      address = ":80"
      [entryPoints.http.redirect]
        regex = "^http://(.*)"
        replacement = "https://$1"
      [entryPoints.https]
      address = ":443"
        [entryPoints.https.tls]
    [acme]
      email = "[e-mail]"
      storage = "/acme/acme.json"
      entryPoint = "https"
      onHostRule = true
        [acme.httpChallenge]
        entryPoint = "http"
    [[acme.domains]]
      main = "*.my-public-domain.com"
      sans = ["my-public-domain.com"]

我的集群发行者：

apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
  name: letsencrypt-dev
spec:
  acme:
    email: [e-mail]
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      # Secret resource used to store the account's private key.
      name: example-issuer-account-key
    # Add a single challenge solver, HTTP01 using nginx
    solvers:
    - http01:
        ingress:
          class: traefik

还有我的考试证书:

apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: example-com
  namespace: default
spec:
  secretName: example-com-tls
  renewBefore: 360h # 15d
  commonName: logger.my-public-domain.com
  dnsNames:
  - logger.my-public-domain.com
  issuerRef:
    name: letsencrypt-dev
    kind: ClusterIssuer

我有通配符域的DNS条目，可以ping它

我的证书停留在< code>OrderCreated状态:

Status:
  Conditions:
    Last Transition Time:  2019-10-08T09:40:30Z
    Message:               Certificate issuance in progress. Temporary certificate issued.
    Reason:                TemporaryCertificate
    Status:                False
    Type:                  Ready
Events:
  Type    Reason        Age   From          Message
  ----    ------        ----  ----          -------
  Normal  OrderCreated  47m   cert-manager  Created Order resource "example-com-3213698372"

订单卡在状态已创建：

Status:
  Challenges:
    Authz URL:  <url>
    Dns Name:   logger.my-public-domain.com
    Issuer Ref:
      Kind:  ClusterIssuer
      Name:  letsencrypt-dev
    Key:     <key>
    Solver:
      http01:
        Ingress:
          Class:  traefik
    Token:        <token>
    Type:         http-01
    URL:          <url>
    Wildcard:     false
  Finalize URL:   <url>
  State:          pending
  URL:            <url>
Events:
  Type    Reason   Age   From          Message
  ----    ------   ----  ----          -------
  Normal  Created  48m   cert-manager  Created Challenge resource "example-com-3213698372-0" for domain "logger.my-public-domain.com"

最后，通过挑战：

Spec:
  Authz URL:  <url>
  Dns Name:   logger.my-public-domain.com
  Issuer Ref:
    Kind:  ClusterIssuer
    Name:  letsencrypt-dev
  Key:     <key>
  Solver:
    http01:
      Ingress:
        Class:  traefik
  Token:        <token>
  Type:         http-01
  URL:          <url>
  Wildcard:     false
Status:
  Presented:   true
  Processing:  true
  Reason:      Waiting for http-01 challenge propagation: wrong status code '404', expected '200'
  State:       pending
Events:
  Type    Reason     Age   From          Message
  ----    ------     ----  ----          -------
  Normal  Started    55m   cert-manager  Challenge scheduled for processing
  Normal  Presented  55m   cert-manager  Presented challenge using http-01 challenge mechanism

我看到有404条回复，但我无法理解其原因。在我的IIS上，我有以下重写规则：让我们绕过加密-所有url都匹配。著名的/*重写为kubernetes主机。http到https-所有url不匹配，让我们加密重定向到https子域重定向-所有子域请求重写为kubernetes。

在我的局域网中，我有自己的DNS服务器，所有域名都来自我的公共域。com具有到内部地址的映射，因此我可以重定向公共主机名logger.my-public-domain。com（x.x.x.x）到内部logger.my-public-domain。com（192.168.0.y）。

当挑战活动时，我会在traefik仪表板中看到新的后端和前端。

也许我误解了它应该如何工作，但我期望证书管理器颁发证书，让我们加密，我可以观察我的服务。

Answer 1

在您的陷阱中。toml正在重定向到HTTPS的ConfigMap：

[entryPoints.http.redirect]
regex = "^http://(.*)"
replacement = "https://$1"

使用kubectl编辑配置图-n库贝-系统traefik删除替换，保存更改然后重新启动Traefik pod。那么你应该可以走了。使用您的In的管理带有注释的重定向，而不是将它们放在Traefik配置中。